Enterprise Deployment

Silent installation, Intune and Configuration Manager packaging, pre-staging policy and tenant configuration, and preparing Windows containers and LeveeFS at scale

IT deploys Levee to many computers with the tools it already uses for MSI packages: Microsoft Intune, Configuration Manager, Group Policy software installation, or a third-party tool. Levee ships as one per-machine MSI, VediramLeveeSetup-<version>-x64.msi. There is no separate agent to register, and nothing to configure inside the MSI itself.

A complete rollout delivers four things to each machine, in this order:

1. Prerequisites: the Windows Containers feature and the .NET 8 runtimes.
2. The Levee MSI. It includes LeveeFS, the file-system driver and service that show users' shared files inside the sandbox.
3. Configuration: a tenant-config.json to connect to Vediram Cloud, a local policy.json, or both.
4. AI tool packages your users will enable. See AI tools.

Silent install and uninstall

Run msiexec from an elevated prompt with /qn. Keep a verbose log so a failed install can be diagnosed.

Install silently with a verbose log:

msiexec /i .\VediramLeveeSetup-<version>-x64.msi /qn /norestart /l*v "$env:SystemRoot\Temp\levee-install.log"

Uninstall silently:

msiexec /x .\VediramLeveeSetup-<version>-x64.msi /qn /norestart /l*v "$env:SystemRoot\Temp\levee-uninstall.log"

MSI facts for packaging

The installer checks the Windows edition, the build, and the ASP.NET Core 8 runtime. If a check fails, the install rolls back before anything changes. It then installs LeveeFS: the file-system driver (LeveeFs) and the LeveeFSHost service. The host-preparation step writes its own log to %SystemRoot%\Temp\levee-prepare-host.log, which is the first place to look when a silent install returns 1603. See Install prerequisite errors.

The install wrapper script

Levee installs an optional helper script for later upgrades and repairs from the same machine. It runs msiexec silently and keeps an archive of install logs. Calling msiexec directly is fully supported.

The script is %ProgramFiles%\Vediram\Levee\setup\install-levee.ps1. It keeps its logs in %ProgramData%\Vediram\Levee\installer\logs\: one log per run, compressed, pruned after 30 days, at most 3 files and 64 MB.

& "$env:ProgramFiles\Vediram\Levee\setup\install-levee.ps1" -MsiPath .\VediramLeveeSetup-<version>-x64.msi

Pass extra msiexec arguments with -MsiArguments.

Enable the Containers feature at scale

Turn on the Windows Containers feature before or alongside the MSI, and plan a restart. The MSI does not enable it.

PowerShell (run as SYSTEM or elevated):

$feature = Get-WindowsOptionalFeature -Online -FeatureName Containers
if ($feature.State -ne 'Enabled') {
    Enable-WindowsOptionalFeature -Online -FeatureName Containers -All -NoRestart | Out-Null
    exit 3010   # tell the deployment tool a restart is needed
}
exit 0

DISM:

dism.exe /Online /Enable-Feature /FeatureName:Containers /All /NoRestart

Golden images and VDI: enable the feature in the image, so every desktop starts with it on.

Until the feature is enabled and the machine restarted, Levee is installed but cannot start projects. The Levee app shows "Windows 'Containers' feature is off".

Microsoft Intune

Package the MSI as a Windows app (Win32), so you can control dependencies, restarts, and detection.

1. Put the MSI in a folder and wrap it with the Microsoft Win32 Content Prep Tool:

   .\IntuneWinAppUtil.exe -c .\levee -s VediramLeveeSetup-<version>-x64.msi -o .\out
   

2. Create a Windows app (Win32) in the Intune admin center with:

   Setting	Value
   Install command	msiexec /i "VediramLeveeSetup-<version>-x64.msi" /qn /norestart /l*v "%SystemRoot%\Temp\levee-install.log"
   Uninstall command	msiexec /x "VediramLeveeSetup-<version>-x64.msi" /qn /norestart
   Install behavior	System
   Device restart behavior	Determine behavior based on return codes
   Return codes	0 success, 3010 soft reboot, 1641 hard reboot, 1603 failed
   Operating system architecture	x64
   Minimum operating system	Windows 11 22H2

   The install and uninstall commands are entered in Intune, not in a PowerShell console, so they use %SystemRoot% syntax.

3. Detection rule: use the MSI product code Intune detects automatically from the package, or a file rule:

   Rule type	Path	File or folder	Detection method
   File	C:\Program Files\Vediram\Levee\bin	levee.exe	File or folder exists

   The product code changes with each Levee version. With automatic MSI detection, a new version is detected as a new app, which is what you want for supersedence.

4. Dependencies: create more Win32 apps and add them as dependencies, so Intune installs them first:

   • The ASP.NET Core Runtime 8.x and .NET Desktop Runtime 8.x installers (x64), from Microsoft.
   • A small "Enable Windows Containers" app that runs the PowerShell script above, with a detection script that checks (Get-WindowsOptionalFeature -Online -FeatureName Containers).State -eq 'Enabled'.

5. Upgrades: add the new version as a new Win32 app that supersedes the previous one, with Uninstall previous version turned off. The MSI upgrades in place and keeps configuration and data.

6. Configuration files: deploy tenant-config.json and, if you use local policy, policy.json with a separate Win32 app or a platform script (see Pre-stage configuration).

Configuration Manager

1. Create an Application with a Windows Installer (*.msi file) deployment type from the MSI. Configuration Manager fills in the product code for detection.

2. Set the installation program to:

   msiexec /i "VediramLeveeSetup-<version>-x64.msi" /qn /norestart /l*v "%SystemRoot%\Temp\levee-install.log"
   

3. Installation behavior: Install for system. Logon requirement: Whether or not a user is logged on.

4. Add dependencies for the .NET 8 runtimes and for a script deployment type that enables the Containers feature.

5. Set Requirements: Operating system Windows 11 x64, and a global condition on the edition if your collections mix editions.

6. For upgrades, create a new application and add a supersedence relationship without uninstalling the previous version.

Group Policy software installation

Levee can be assigned to computers with Group Policy software installation. The MSI has no transforms or properties to set. Group Policy software installation cannot deploy the .NET runtimes or enable Windows features, so handle those with a startup script or another tool first.

Pre-stage configuration

Two optional files tell Levee which tenant it belongs to and which rules to enforce. Neither is installed by the MSI. Both live in %ProgramData%\Vediram\Levee\.

Both files must be writable only by SYSTEM and Administrators. tenant-config.json contains your tenant's provisioning key, so it must not be readable by standard users either. Levee does not change the permissions on these files. Set them when you deploy:

$dir = "$env:ProgramData\Vediram\Levee"
New-Item -ItemType Directory -Force -Path $dir | Out-Null

# tenant-config.json: SYSTEM and Administrators only
$tenant = Join-Path $dir 'tenant-config.json'
@'
{ "apiKey": "vdm_REPLACE_WITH_YOUR_PROVISIONING_KEY" }
'@ | Set-Content -Path $tenant -Encoding utf8NoBOM
icacls $tenant /inheritance:r /grant:r '*S-1-5-18:(F)' '*S-1-5-32-544:(F)'

# policy.json: SYSTEM and Administrators only
$policy = Join-Path $dir 'policy.json'
Copy-Item .\policy.json $policy -Force
icacls $policy /inheritance:r /grant:r '*S-1-5-18:(F)' '*S-1-5-32-544:(F)'

*S-1-5-18 is LocalSystem and *S-1-5-32-544 is the local Administrators group, so the commands work on any Windows display language.

You can deploy these files before or after the MSI. Levee picks up a new or changed policy.json within a second, without a restart. A tenant-config.json is read when the Levee service starts, so after adding or changing it, restart the service:

Restart-Service LeveeService

Before you deploy a policy, validate its JSON on a test machine with levee policy show after placing it, and review the project's Access Policy tab in the app.

Publish AI tools

AI tools are delivered separately from the MSI. Levee does not include any AI tool. Tool packages are placed under %ProgramData%\Vediram\Levee\tools\. Deploy them with the same tooling as the MSI. See AI tools for the folder layout and how users enable tools.

Verify a deployed machine

Run these checks on a sample of machines from an elevated PowerShell. A healthy machine shows both Levee services running, the LeveeFSHost service present, the feature enabled, levee doctor exiting 0, and a ready runtime.

Get-Service LeveeService, LeveeContainerEngine, LeveeFSHost | Format-Table Name, Status, StartType
(Get-WindowsOptionalFeature -Online -FeatureName Containers).State
& "$env:ProgramFiles\Vediram\Levee\bin\levee.exe" doctor
& "$env:ProgramFiles\Vediram\Levee\bin\levee.exe" runtime status
& "$env:ProgramFiles\Vediram\Levee\bin\levee.exe" policy show

LeveeFSHost is started by Levee for each running project, so it is normally stopped when no project runs.

Next steps

• Connecting to Vediram Cloud
• Container runtime: control where the runtime image comes from.
• Updates & uninstall